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WE CLAIM: 

1 . A computer program product operable to control a computer to issue an alert 

5 for an out-of-date update status of a malware scanner, said computer program product 
comprising: 

(i) reading logic operable to read an update status field associated with a 
computer file to be scanned by a current malware scanner, said update status field 
being indicative of an update status of a previous malware scanner that has scanned 

10 said computer file and associated said update status field with said computer file; 

(ii) comparison logic operable to compare said update status of said 
previous malware scanner with an update status of said current malware scanner; and 

(iii) alert issuing logic operable if said update status of said current 
malware scanner does not match said update status of said previous malware scanner 

15 to issue an update status alert indicative of an out-of-date update status for whichever 
one of said current malware scanner and said previous malware scanner has a most 
out-of-date update status. 

2. A computer program product as claimed in claim 1 , wherein said update status 
20 field is included as a property field within said computer file. 

3. A computer program product as claimed in claim 1 , wherein said update status 
field is included within an update status file passed together and associated with said 
computer file between malware scanners. 

25 

4. A computer program product as claimed in claim 3, wherein said update status 
file and said computer file are combined into a combined file that is passed as a single 
entity between malware scanners. 

30 5. A computer program product as claimed in claim 4, wherein said combined 
file is a file compressed combination of said update status file and said computer file. 

6. A computer program product as claimed in claim 1 , wherein, if said current 
malware scanner has a less out-of-date update status than said previous malware 
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scanner, then said update status field associated with said computer file is changed to 
correspond to said current malware scanner. 

7. A computer program product as claimed in claim 6, wherein changes to said 
update status field are logged in an update status tracking database. 

8. A computer program product as claimed in claim 1, wherein said update status 
alert includes one or more of: 

(i) a user alert issued on whichever one of said current malware scanner 
and said previous malware scanner has a most out-of-date update status; and 

(ii) an administrator alert issued to an administrator of whichever one of 
said current malware scanner and said previous malware scanner has a most out-of- 
date update status. 

9. A computer program product as claimed in claim 1, wherein said computer file 
is an e-mail attachment. 

10. A computer program product as claimed in claim 1 , wherein said current 
malware scanner and said previous malware scanner are part of a tiered malware 
scanner. 

11. A computer program product as claimed in claim 1 , wherein said update status 
field includes one or more of: 

(i) a malware scanner computer program product identifier; 

(ii) a computer hardware identifier; 

(iii) a scanner engine program version identifier; and 

(iv) a malware definition data version identifier. 

12. A computer program product as claimed in claim 1 , wherein said malware 
scanner serves to detects one or more of: 

(i) a computer virus; 

(ii) a Trojan computer program; 

(iii) a worm computer program; 

(iv) a banned computer program; and 



13 



DYCRef:P011578US 
NAIRefiO 1.018.01 



(v) banned content within a e-mail. 

13. A method of alerting an out-of-date update status of a malware scanner, said 
5 method comprising the steps of: 

(i) reading an update status field associated with a computer file to be 
scanned by a current malware scanner, said update status field being indicative of an 
update status of a previous malware scanner that has scanned said computer file and 
associated said update status field with said computer file; 

10 (h) comparing said update status of said previous malware scanner with an 

update status of said current malware scanner; and 

(iii) if said update status of said current malware scanner does not match 
said update status of said previous malware scanner, then issuing an update status 
alert indicative of an out-of-date update status for whichever one of said current 

15 malware scanner and said previous malware scanner has a most out-of-date update 
status. 

14. A method as claimed in claim 13, wherein said update status field is included 
as a property field within said computer file. 

20 

15. A method as claimed in claim 13, wherein said update status field is included 
within an update status file passed together and associated with said computer file 
between malware scanners. 

25 16. A method as claimed in claim 1 5, wherein said update status file and said 
computer file are combined into a combined file that is passed as a single entity 
between malware scanners. 

17. A method as claimed in claim 1 6, wherein said combined file is a file 
30 compressed combination of said update status file and said computer file. 

18. A method as claimed in claim 13, wherein, if said current malware scanner has 
a less out-of-date update status than said previous malware scanner, then said update 
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status field associated with said computer file is changed to correspond to said current 
malware scanner. 



19. A method as claimed in claim 1 8, wherein changes to said update status field 
5 are logged in an update status tracking database. 



20. A method as claimed in claim 13, wherein said update status alert includes one 
or more of: 

(i) a user alert issued on whichever one of said current malware scanner 
10 and said previous malware scanner has a most out-of-date update status; and 

(ii) an administrator alert issued to an administrator of whichever one of 
said current malware scanner and said previous malware scanner has a most out-of- 
date update status. 



15 21. A method as claimed in claim 13, wherein said computer file is an e-mail 
attachment. 



22. A method as claimed in claim 1 3, wherein said current malware scanner and 
said previous malware scanner are part of a tiered malware scanner. 

20 

23. A method as claimed in claim 13, wherein said update status field includes one 
or more of: 

(i) a malware scanner computer program product identifier; 

(ii) a computer hardware identifier; 

25 (iii) a scanner engine program version identifier; and 

(iv) a malware definition data version identifier. 



24. A method as claimed in claim 13, wherein said malware scanner serves to 
detects one or more of: 

(i) a computer virus; 

(ii) a Trojan computer program; 

(iii) a worm computer program; 

(iv) a banned computer program; and 

(v) banned content within a e-mail. 
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25 . Apparatus for issuing an alert for an out-of-date update status of a malware 
scanner, said apparatus comprising: 

(i) a reader operable to read an update status field associated with a 

5 computer file to be scanned by a current malware scanner, said update status field 
being indicative of an update status of a previous malware scanner that has scanned 
said computer file and associated said update status field with said computer file; 

(ii) a comparitor operable to compare said update status of said previous 
malware scanner with an update status of said current malware scanner; and 

10 (iii) an alert issuer operable if said update status of said current malware 

scanner does not match said update status of said previous malware scanner to issue 
an update status alert indicative of an out-of-date update status for whichever one of 
said current malware scanner and said previous malware scanner has a most out-of- 
date update status. 

15 

26. Apparatus as claimed in claim 25, wherein said update status field is included 
as a property field within said computer file. 

27. Apparatus as claimed in claim 25, wherein said update status field is included 
20 within an update status file passed together and associated with said computer file 

between malware scanners. 

28. Apparatus as claimed in claim 27, wherein said update status file and said 
computer file are combined into a combined file that is passed as a single entity 

25 between malware scanners. 

29. Apparatus as claimed in claim 28, wherein said combined file is a file 
compressed combination of said update status file and said computer file. 

30 30. Apparatus as claimed in claim 25, wherein, if said current malware scanner 
has a less out-of-date update status than said previous malware scanner, then said 
update status field associated with said computer file is changed to correspond to said 
current malware scanner. 
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3 1 . Apparatus as claimed in claim 30, wherein changes to said update status field 
are logged in an update status tracking database. 

32. Apparatus as claimed in claim 25, wherein said update status alert includes 
one or more of: 

(i) a user alert issued on whichever one of said current malware scanner 
and said previous malware scanner has a most out-of-date update status; and 

(ii) an administrator alert issued to an administrator of whichever one of 
said current malware scanner and said previous malware scanner has a most out-of- 
date update status. 

33. Apparatus as claimed in claim 25, wherein said computer file is an e-mail 
attachment. 

34. Apparatus as claimed in claim 25, wherein said current malware scanner and 
said previous malware scanner are part of a tiered malware scanner. 

35. Apparatus as claimed in claim 25, wherein said update status field includes 
one or more of: 

(i) a malware scanner computer program product identifier; 

(ii) a computer hardware identifier; 

(iii) a scanner engine program version identifier; and 

(iv) a malware definition data version identifier. 

36. Apparatus as claimed in claim 25, wherein said malware scanner serves to 
detects one or more of: 

(i) a computer virus; 

(ii) a Trojan computer program; 

(iii) a worm computer program; 

(iv) a banned computer program; and 

(v) banned content within a e-mail. 
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